Forums
Main Category
General (Technical,...
Script/Utility to C...
 
Notifications
Clear all

Script/Utility to Convert .CSV to EnCase .HASH

 
General (Technical, Procedural, Software, Hardware etc.)
Last Post by jcas1411 17 years ago
8 Posts
3 Users
0 Reactions
527 Views
RSS
 jeffcaplan
(@jeffcaplan)
Trusted Member
Joined: 21 years ago
Posts: 97
Topic starter 02/08/2008 5:05 pm  

I was thinking about just making this a PM to Harlan, but in the chance that someone else out there can answer this question or may benefit from the answer, I'm posting it here, obviously.

If my memory is correct, I seem to recall a PERL script floating around 3-4 years ago which could convert a .CSV file to an EnCase .HASH file. Is anyone familar with this or has a copy? If not this particular script, then how about any other utility or method I could use to quickly convert a bunch of .CSV files containing a Hash Set Name/Category and list of MD5 hash values into a usable .HASH format file. Thanks!

Jeff


   
Quote
keydet89
 keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
02/08/2008 5:08 pm  

http//www.nsrl.nist.gov/Documents/CreatingHashSetsmanually.pdf


   
ReplyQuote
 jeffcaplan
(@jeffcaplan)
Trusted Member
Joined: 21 years ago
Posts: 97
Topic starter 02/08/2008 5:19 pm  

Not the script I was looking for, but it certainly answers the question.

Thanks for the speedy response, Harlan! )

Jeff


   
ReplyQuote
keydet89
 keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
03/08/2008 12:40 am  

I don't know of a script that will convert a .csv file to an EnCase .hash file. This is the only way I'm aware of to get from *any* format to an EnCase .hash file format.


   
ReplyQuote
 jcas1411
(@jcas1411)
New Member
Joined: 17 years ago
Posts: 2
27/09/2008 8:31 pm  

You may have it already solved (format for encase .Hash is on wiki) but I just got through writing a converter to go both ways, Encase to CSV and CSV to Encase. I received the Encase file format from them (sorry cant post it). I produced a version of it for Encase to post in their forum along with source code (VB.NET).


   
ReplyQuote
keydet89
 keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
27/09/2008 8:43 pm  

I ran into an issue w/ hash comparisons in EnCase, and instead of looking for ways to address a proprietary binary format, opted to use EnCase conditions instead.


   
ReplyQuote
keydet89
 keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
27/09/2008 8:46 pm  

You may have it already solved (format for encase .Hash is on wiki) but I just got through writing a converter to go both ways, Encase to CSV and CSV to Encase. I received the Encase file format from them (sorry cant post it). I produced a version of it for Encase to post in their forum along with source code (VB.NET).

All…

http//www.forensicswiki.org/index.php?title=Encase_hash_files

Converter should be trivial.


   
ReplyQuote
 jcas1411
(@jcas1411)
New Member
Joined: 17 years ago
Posts: 2
02/10/2008 4:51 am  

You may have it already solved (format for encase .Hash is on wiki) but I just got through writing a converter to go both ways, Encase to CSV and CSV to Encase. I received the Encase file format from them (sorry cant post it). I produced a version of it for Encase to post in their forum along with source code (VB.NET).

All…

http//www.forensicswiki.org/index.php?title=Encase_hash_files

Converter should be trivial.

yes.. as I said on wiki, but I can tell not all the fields are correct (seeing from the format I received from Encase). I talked with Encase today, If you can access their support forum (for people with license) the converter I wrote will be posted along with source.


   
ReplyQuote
Forum Jump:
  Previous Topic
Next Topic  
Share: